02-12-2019 06:43 AM - edited 03-12-2019 07:17 AM
Does Firepower have the ability to query the Firepower API for an MD5 to see if FP has seen it before?
Does Firepower have the ability to block a given MD5 via the API?
02-12-2019 10:09 AM
I don't believe Cisco has exposed file checks via the API yet - at least I didn't see it referenced in the 6.3 API Guide:
https://www.cisco.com/c/en/us/support/security/defense-center/products-programming-reference-guides-list.html
If they did, it would not be MD5 since AMP (the component that handles file policies) uses exclusively SHA-256.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide
Log in to Community